Keylane compared with Signal, Matrix, Session, Threema and SimpleX

On the phone itself

Two of those rows are a design choice rather than a scoreboard. Encrypting the whole database file, which is what SQLCipher does for Signal, Session and SimpleX, leaves nothing legible without the key — the structure in the last row included. Encrypting record by record, as Keylane does, leaves that structure exposed but means a running app never holds a decrypted archive at all: only what is on screen is in the clear, and the key comes out of hardware one operation at a time, so a live memory capture takes the screen rather than the history. The cipher strength is equivalent either way; the two choices survive different attacks. The reasoning, and what it costs us, in full.

Signal

On Android the message database is SQLCipher-encrypted, but its key is wrapped by an Android Keystore entry the app can use at any moment, with no PIN or passphrase in front of it. A full-filesystem extraction plus Keystore access reads the whole history; the app’s screen lock gates the interface, not the key. On desktop that key sat in plain text in config.json for roughly six years, until a change in July 2024 moved it behind Electron’s safeStorage — DPAPI on Windows, Keychain on macOS, the session keyring on Linux. That stops a different user account on the same machine. It does not stop code running as you, which is the case that matters.

Session

A Signal fork, so its mobile storage behaves much the same. On desktop it is a step behind: the SQLCipher key is written to config.json in the clear unless you set an application password, and published forensic walkthroughs treat that file as the entire answer. Setting the password is the difference between an encrypted database and a decorative one.

Matrix

There is no single answer, because Matrix is a protocol with many clients — which is itself the finding. Element Android encrypts its local store under a Keystore-held key; Element Desktop keeps its pickle key in the system keyring; Element Web holds room data and crypto state in IndexedDB, protected by browser-profile boundaries rather than by anything you supply. Assume nothing about a given Matrix client until you have read that client’s own storage documentation.

Threema

One of the two apps here, with SimpleX, that will put a secret of yours in front of the database. On Android its own AES-256 layer covers messages, media, and the ID private key, and the master key can be wrapped in an optional Master Key Passphrase, re-entered after every restart; Threema states plainly that without one the protection is limited. On iOS it leans on the platform instead — Data Protection keyed to your device passcode, with the ID key in the Keychain. Its in-app PIN lock is a UI gate with no cryptography behind it. Worth noting against our own row above: a well-chosen Master Key Passphrase used to resist an offline attack on a copied store better than a Keylane PIN could, because it took arbitrary characters where ours took ten digits. That gap is closed — Keylane’s secret now takes the same arbitrary characters — and the difference that remains is which way round the protection is optional: Threema’s passphrase is opt-in and Android-only, and without one Threema says plainly that the protection is limited, while a Keylane secret is required on every platform.

SimpleX

Its SQLCipher database is opened with a passphrase generated at random when you install, and kept in the platform store — on iOS as a Keychain item created with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, which is precisely the state a seized phone is normally in. An extraction that reaches the keychain therefore reads the whole database, and SimpleX Lock gates the interface rather than the key. It also offers the strongest opt-out on this page: you can replace that random passphrase with one of your own and decline to store it on the device at all, after which a stopped app yields nothing and the offline attack is bounded by your passphrase over PBKDF2-SHA512, at iteration counts comparable to ours. The costs are typing it at every launch and losing reliable notifications, and it is off by default. On desktop the database is not encrypted at all unless you choose a passphrase — skip the prompt and the random one is written to disk in the clear. Two things SimpleX has that we do not: everything lives inside the encrypted database, including the metadata we leave legible, and a self-destruct passcode wipes the data and opens a decoy profile.

Keylane

Records and files are encrypted individually rather than by locking one database, under a random 256-bit key. Your PIN does not become that key; it derives, through 600,000 PBKDF2 iterations, the key that unwraps the profile the storage key sits in. While the app runs, the storage key is instead sealed by a Secure Enclave or Keystore key that is deleted outright the moment Keylane locks, so an image captured after that cannot be opened later, by an examiner or by us. Two honest costs. The shape around the content — timestamps, ordering, unread counts, your contacts’ Keylane IDs, live ratchet state — is stored in the clear. And an adversary holding a copy of the profile can attack it offline, where no attempt limit applies, at whatever the secret is worth: four digits is trivial, ten digits is around thirty-three bits and a matter of days on rented GPUs. That ceiling is a property of digits rather than of the derivation, which is why the keypad also draws letters, numbers and symbols — 4–32 characters, no system keyboard involved, so nothing you type passes through a third-party IME. Ten mixed characters is roughly sixty-five bits — on the order of four billion times the work — and a short passphrase is more again; the same 600,000 iterations then run over it unchanged. Two honest caveats on that: the numeric pad is still the default, and a random key sealed in a phone’s secure hardware, as Signal uses, has no offline attack against it at all, whatever you type. The whole design is written out in client security.